Wolfram Research webMathematica 4.0 File Disclosure Vulnerability

ID EDB-ID:21562
Type exploitdb
Reporter Andrew Badr
Modified 2002-06-17T00:00:00


Wolfram Research webMathematica 4.0 File Disclosure Vulnerability. CVE-2002-0926. Webapps exploit for java platform

                                            source: http://www.securityfocus.com/bid/5035/info

Wolfram Research's webMathematica is a Java based product which allows the inclusion of Mathematica content in a web environment. It includes CGI programs which generate image content based on user supplied input.

A file disclosure vulnerability has been reported with the MSP CGI program. A file name parameter supplied by the user is not properly validated. The inclusion of "../" character sequences allows the attacker to escape the web root, and view arbitrary system files.